Google Security Operations

Hi Team, How I can monitor my networking through the Siemplify community Edition?

Does anyone know how to add multiple value of script result in placeholder and create new insights? Is it possible? Or Im need to create action block for every insight?

Any thoughts on where I'm going wrong trying to subtract 30 minutes from this timestamp using Functions > Convert Time Format ? The input is 2021-09-10T19:00:06.951Z and the broken output is %Y-%32-%5T%18:%9:%9.%f+0000 . I'd like to return 2021-09-10T18:30:06.951Z . I suspect it has something to do with my time format being off ( %Y-%m-%dT%H:%M:%S.%fZ ) View files in slack

I'm inside container with siemplify server and I'm not able to find config files (alas there is no /opt/siemplify/siemplify_server/Configs directory): # find /opt/siemplify/ -name Siemplify_Main_Config.xml # find /opt/siemplify/ -name CasePrioritization.config # find /opt/siemplify/ -iname '*ConnectorsEngine*' # These files are referenced in SCSO course (and in other places)... And I'm not sure what version i'm running: # cat /opt/siemplify/siemplify_server/bin/Siemplify.version 5.6.1.89 # cat /opt/siemplify/siemplify_server/Version.txt 5.6.1.133 ;-)

Hi team, I have some small questions about siemplify UI. Not sure if this is the right place to ask, but. Is possible to render images that were handled in the playbook on siemplify? I know for fact that we can download them on case wall, but I was wondering if siemplify is able to render and show to the user anywhere. Also, is possible to format text that is shown on insight and case wall? Something like bold, italic and larger fonts.. is possible to select more than one case and make bulk actions, such as delete? Thanks

Has anyone seen/heard/tried any Siemplify integration with Velociraptor? https://www.velocidex.com/ . We’ve been using it with great success and it’s a key piece of our endpoint strategy. It’s owned by Rapid7 now and continues to move in a good direction.

Hi, i just have a question about if it is possible to extract the number of events that shows in every alert that I have, I would use this number of events to multiple purposes like send an email alert, extract to csv, etc. View files in slack

Anyone know if there's a way to increase the # of cases shown on the left side (currently 15)?

Dear Community, has any one had a use case scenario where you had to create an entity such as 2 users in a case and needed to display an insight for this two separate users as in the case of active directory enrichment? Since the AD only contains an enrich all action, it will enrich both users, but haven't been able to come up with out to display insights seperately based on each user enrichment

Hi! If anyone know and can help me for my case: a) How can I re-run a Playbook on an Alert that has already executed it previously? b) How can I delete assigned Playbook from Alert? c) Can I run some Playbook from another existing Playbook (Playbook in Playbook)?

Can anyone tell why this condition took the "else" path (#2)? View files in slack

Hi everyone, I have some issues - how can we automatically add some IP addresses from entities located in the Alert to BlackList menu on Siemplify settings? I can’t find this type of actions in Playbooks. Could someone navigate me, please? Summary, goal is to add some IP addresses (from Entities Alerts) to BlackList directly from Playbooks.

Dear Community, please can anyone share how Siemplify is being leveraged in proactive threat hunting?

Hi, is it possible to use multiple triggers for a playbook?

Hello, I wonder if there is a way to create a timestamp with e..g. 14 dasy from now, using any built in actions? I see time format converter, get current time, but did not found how could I add +14 days, so I could use that new timestamp in my next action. Appreciate any hint, if it exists. If not, I will likely write a custom action of a few liner…

Hey Folks, is there anyone that knows where in the back end to reset the admin password of a siemplify community edition?

Hello all, how do I add enriched data to entity so that it will show in entity explorer I was told I can use flat_user_data = {"key1":"value1"} entity.additional_properties.update(flat_user_data) but it's throwing error how do I define entity?

Any thoughts on how we may filter IP address entities to pull out only IPv4 addresses to pass on for enrichment? We're sending a bunch of IPv6 addresses that aren't interesting or useful to pay to lookup.

Hello Community, Wondering if anyone has a use case or directions based on best practices of how Siemplify can be leveraged in the investigation and response of a probable web shell attack detection? Thanks.

Hey, I have a rather long question around email communication: siemplify has kind of a weak side when it comes to communication that leaves the tool. For example, if I need to send out an email to clarify something, the possible variants could be There are A LOT of things that could go wrong with either of them, such as Currently there are individual "solutions" for some of these problems, but they are all very problem-focussed (e.g. "send email and wait for reply from all recipients" is a dedicated option in the action). In addition, playbook actions have a quite short timeout value, i.e. it's not really possible to wait for multiple days for a reply. In a scenario where we need email communication right now, we know that we'll wait for at least 1 reply email, but multiple emails may likely be received and all of them should be merged into the case. I&#3

As a MSSP we often have to send emails to customers based on case data. We already use playbooks and templates to send them. Is there a way to add a rich editor which would allow sending screenshots as well?

Not afraid to ask a potentially silly question....how do I rename reports? The only way I've found is to export, rename it in the json, and re-import it

Hey, I'm having an issue with my community edition and accessing the use cases. When I try to "Get Use Cases" I receive an error stating "one or more error has occurred (The SSL cert could not be established, Please see Inner Exception)" I know its something on our end blocking it as working off network allows me to access the use cases no problem. The issue I am having is when I click the error, nothing shows up, how can I view the errors/exceptions? Can this be done in the console? Thanks View files in slack

Good day all, I have a question today. Currently I use the Exchange Connector to create cases from emails reported to Security by our userbase. The org is starting to roll out some O365 stuff which includes a Button to report emails to O365. These reported emails get attached to a new email, from O365, and arrive at some mailbox. In short, I receive an email from O365 that says an email was reported with O365's assessment and the original email is attached. I want to use the Exchange Connector to ingest these emails, take some data from the body (easy part) and then ingest the attached message . From the attached message I would want to obtain the same data I would normally receive as if the Exchange Connector directly ingested that message. Any thoughts on how I could do this?

I have a problem with the trendmicro deep security connector (or maybe a global problem with the lack of configuration of the TLS Root CA file). While testing the connection (with or without TLS enabled) I get the error: "IOError: Could not find a suitable TLS CA certificate bundle, invalid path: False" - I am browsing the documentation, but I can't find anything about it. Please help